Complys
Home → Guides → What is a health and safety management system?
H&S software

What is a health and safety management system?

Learn what a health and safety management system does, how HSE Plan Do Check Act works, and where legal duties differ from voluntary ISO 45001.

A health and safety management system is the way an organisation plans, carries out, checks and improves its arrangements for preventing harm at work. It connects decisions about risks with the people, controls, information and follow-up needed to make those decisions work. It can be simple. A small employer might use a clear policy, relevant risk assessments, agreed responsibilities and a dependable way to check whether controls are working. A larger or more hazardous operation may need more formal coordination across sites, contractors, equipment and managers.

This guide is for employers operating in Great Britain. It explains the Health and Safety Executive's management approach and the legal duty to make suitable health and safety arrangements. It does not treat a named framework, a certificate or a software score as proof that a workplace is safe. Northern Ireland has a separate regulator and legal framework; an employer there should use the relevant local sources rather than assume every GB reference here applies.

The first distinction is important. Under regulation 5 of the Management of Health and Safety at Work Regulations 1999, a GB employer must make and give effect to arrangements appropriate to its activities and size for planning, organising, controlling, monitoring and reviewing preventive and protective measures. An employer with five or more employees must record those arrangements. The law does not say that every employer must buy a formal management system or obtain ISO 45001 certification. HSE says a formal framework is a choice, and warns against needless paperwork that does not improve control of risk.

The useful question is therefore not “Which certificate do we need?” It is “Can our people explain the risks, use the agreed controls, notice when they fail and make changes that last?” The rest of this guide turns that question into a practical management routine.

What the system is meant to achieve

A working system gives an employer a reliable route from identifying work to controlling it. Leaders decide the organisation's priorities and resources. People who understand the work identify hazards and help design controls. Managers make sure those controls are available and used. The organisation checks what actually happens, deals with defects and learns from changes and incidents. Those elements reinforce each other; a policy statement alone cannot operate a machine guard or tell a contractor where a hidden service runs.

HSE describes health and safety management as an ongoing process rather than a one-off exercise. Its introduction to managing health and safety recommends a Plan, Do, Check, Act approach. The approach helps an organisation test whether arrangements work in practice and improve them. It is regulator guidance on management, not a separate statutory form that must have those four headings.

The form of the system should follow the business. A low-risk office should not copy every document used on a complex construction site. A business with several locations, hazardous substances or changing contractors may need clearer handovers and more structured checks. HSE's management-system guidance expressly says that the approach should be proportionate and cautions against excessive documentation. “Proportionate” does not mean omitting a control because it is inconvenient. It means putting effort where the work presents risk and where evidence will help people act.

There are three tests of usefulness. First, can a person doing the job find and understand the instruction or control they need? Second, can a supervisor find out whether that control is in place today? Third, when the work or risk changes, is there a clear way to update the arrangement and tell the people affected? A system that passes those tests is more valuable than a large folder no one uses.

The legal arrangements and the documents are different things

Regulation 5 requires the employer to make and give effect to suitable arrangements. The second part matters: a document describing a process is not enough if the process is absent at the workplace. The regulation names planning, organisation, control, monitoring and review, and says the arrangements should reflect the nature of the activities and the size of the undertaking. It sets a specific recording threshold of five or more employees. That threshold concerns recording the arrangements, not whether a smaller employer must manage risks at all.

Risk assessment is a linked legal duty. Regulation 3 requires an employer to assess risks to employees and others arising from its undertaking so it can identify the measures needed. HSE's risk-assessment guidance explains the practical sequence: identify hazards, decide who might be harmed and how, evaluate and control the risks, record significant findings where required, and review when necessary. The management system makes sure the assessment informs work, equipment, training, supervision and later review.

A health and safety policy is related but different. Under section 2, subsection 3 of the Health and Safety at Work etc. Act 1974, employers must prepare and revise a written statement of general policy and the organisation and arrangements for carrying it out, subject to the statutory small-employer exception. HSE explains that every business should have a policy and that one with five or more employees must write it down. A policy states direction and responsibilities. It does not replace a job-specific risk assessment, a safe method of work or a check that a control is functioning.

Consultation also belongs in the management process. HSE's employee-consultation guidance explains employers' duties to consult workers on health and safety matters and the routes through representatives or direct consultation, depending on the workplace. Consultation is useful because people doing the task often know where an instruction is unclear, a control is bypassed or conditions have changed. It is not enough to ask for comments after all decisions have been made and then ignore relevant information.

Finally, the Management Regulations' competent-person provision requires employers to appoint one or more competent people to help them meet relevant health and safety requirements, subject to the regulation's details. HSE advises businesses on getting competent help. The employer still has to make decisions and provide resources; naming a consultant does not transfer every duty to that person.

Use HSG65 to organise the work

HSG65, Managing for health and safety, is HSE guidance built around Plan, Do, Check, Act. It gives leaders a way to ask whether risks are being managed and whether the approach improves. A business may use HSG65, another suitable framework or a simpler set of arrangements. The useful discipline is to connect each stage to actual work.

Plan: understand the work and decide who will do what

Start with the work the organisation really performs, including non-routine tasks, maintenance, deliveries, new starters, visitors and contractor interfaces. Identify significant hazards and existing controls. Check what applicable legal requirements and authoritative guidance matter to that work. Do not assume a generic web checklist captures every site or activity.

Set a clear policy direction and assign responsibilities. A manager needs authority to stop or change unsafe work. A supervisor needs to know when a risk assessment must be reviewed. Workers need a route to report a defect without guessing who owns it. Where two businesses share a workplace or a task, specify who provides site information and how they coordinate. A sentence saying “everyone is responsible” is too vague to settle a handover.

Planning also means deciding what resources are needed. An agreed control may require a maintained guard, suitable equipment, time for training or a competent contractor. If the resources do not exist, the plan is not implementable. Record enough to communicate the decision and prove who will act, especially where the law requires recorded arrangements or risk-assessment findings. Do not create a universal form library simply because a template exists.

Do: put controls into operation

“Do” is where a management system becomes visible. Provide information and instruction people can use, organise the work so controls remain practical, and check that supervisors can recognise when the plan no longer fits. HSE's managing guidance puts competent people, worker involvement, risk profiling and implementation in this stage.

For a machine task, this might mean a suitable guard, a defined isolation procedure, access to instructions and a person who can deal with a reported fault. For work involving a contractor, it might mean exchanging site hazards, agreeing the scope and checking the proposed controls before the contractor starts. For an office, it may mean straightforward arrangements for equipment, welfare, first aid and reporting changes. These are illustrations, not a claim that every named control is legally required in every workplace.

Avoid the paperwork trap. A signed acknowledgement can show that information was issued, but it cannot show that the person understood it or that the control is in place. A training record may demonstrate a session occurred, but supervision and observation can reveal whether a task is being performed as intended. Use records to support decisions, not as a substitute for seeing the work.

Check: look for evidence that controls are working

Checking includes looking at work before something goes wrong and learning when it does. Supervisors can observe tasks, ask workers about difficult steps and inspect equipment or work areas according to the relevant risk and applicable rules. Incident and near-miss information can show where arrangements failed. The check should ask whether the control reduces the actual risk, not merely whether a field has been completed.

There is no universal HSG65 rule that every employer must inspect every activity on the same day of the week or score safety on a fixed scale. The nature of the work and any specific legal inspection requirement determine the suitable method and timing. A high-risk activity that changes daily needs a different check from a stable, low-risk arrangement. Record findings in a way that makes an owner, action and follow-up clear. A list of open defects with no decision about continued work is weak evidence of control.

Use several kinds of evidence. A risk assessment, a maintenance record and a worker report can each reveal a different part of the picture. If a paper procedure says a guard must be used but operators repeatedly remove it to complete the job, the system should investigate why and redesign the task or control. Blaming the operator without examining the work may leave the hazard untouched.

Act: fix causes and update the arrangements

The last stage is a management response, not a ceremonial annual review. Where a check finds a gap, decide what immediate protection is needed, who will investigate and how to prevent recurrence. A change of equipment, process, contractor, staffing or site layout can call for a revised assessment and communication to affected people. HSE's HSG65 guidance frames this as learning and improving performance.

Review should ask whether the original plan still fits the work. If a new control creates a different hazard or is routinely bypassed, a completed action item does not prove the underlying issue is settled. Check the change in use. Tell workers what changed and why. Update the relevant instruction or record so the next shift sees the current arrangement, not an obsolete copy.

An organisation can review at planned intervals and when meaningful changes or evidence arise. The exact review pattern is a business decision informed by risk and any specific legal requirement. Do not print a made-up universal review deadline on every policy or assessment. The purpose is to catch ineffective arrangements in time to improve them.

A worked example: a small maintenance business

Imagine a GB maintenance business with eight employees. Its technicians work at client premises and sometimes use powered access equipment. This example illustrates how the system can connect decisions; it is not a complete assessment for a real site. Before adopting any control, the employer would need to examine its own tasks, equipment, people and applicable requirements.

At the Plan stage, the business identifies routine jobs, occasional work at height, electrical isolation and client-site hazards. It decides who assesses the work, who has authority to reject an unsafe access method, and who receives site information from the client. It records its regulation 5 arrangements because it has at least five employees. It prepares a written health and safety policy and records relevant risk-assessment findings. For each job, it asks whether the generic controls actually fit the site.

At the Do stage, a coordinator sends the technician the site details available before attendance. The technician checks conditions against the planned method and contacts the supervisor when access or isolation differs from the brief. The business provides appropriate equipment, instruction and competent supervision for the work. A contractor or client handover records who controls the work area and who can authorise changes. None of these examples means a particular software workflow is mandatory.

At the Check stage, the supervisor reviews selected completed jobs and asks whether the intended controls were available and used. A report that access equipment did not fit one site is treated as evidence about the planning process. The business also checks equipment and records according to the applicable requirements for that equipment, rather than assuming all items share one inspection interval.

At the Act stage, management changes the pre-visit questions so the access restriction is identified earlier, reviews the affected method and tells the team what changed. It then checks later jobs to see whether the change solved the problem. Merely closing the first report after sending an email would not demonstrate that the control works.

This example shows the value of a management system without claiming that a company of eight needs a certification programme. The statutory duties still apply; the four HSG65 labels are a way to organise a sensible response.

When does a formal framework help?

A formal framework may help when many teams, sites or contractors need consistent governance, when responsibilities are complex, or when an organisation wants external certification for its own commercial reasons. It can give leaders a common structure for policy, objectives, evaluation and improvement. It can also add administrative work. The decision should reflect the risks, organisation and expected benefit, not an assumption that every business must purchase a certificate.

HSE's management-system page says a formal system is not required by law. HSE also explains that a system should not become paperwork for its own sake. That distinction protects both small and large employers. A small business still needs suitable arrangements; a large business cannot rely on a certificate if its workplace controls fail.

ISO 45001 is a voluntary occupational health and safety management framework. HSE's ISO 45001 discussion explains its relationship with legal duties and the way regulators view evidence. Certification can be part of a business's management approach, but it does not replace compliance with the law or prove that every risk is adequately controlled. A team considering the standard should examine its actual requirements separately from the legal duties that apply to its work.

If a client asks for an “SMS”, establish what it actually wants. It may mean evidence of a written policy and working risk controls, a particular assessment framework, or formal certification. Those are different deliverables. Do not claim a legal requirement for certification because a procurement questionnaire asks for it. Equally, do not dismiss a contractual condition simply because it is not a statutory duty: clarify the contract and the evidence the customer requires.

What should an employer keep in its system?

There is no universal folder that proves compliance. A practical starting set may include the policy and assigned roles, relevant risk assessments, agreed controls and work instructions, evidence of information or training where needed, maintenance or inspection evidence where applicable, consultation records, incident learning and action follow-up. The exact set depends on the work and the applicable law. Some records have specific legal requirements; others are useful management evidence rather than prescribed documents.

Make each record serve a decision. A risk assessment should inform the controls for a task. An action log should identify who will fix a defect and whether work may continue meanwhile. A handover should tell the next person which version of the method is current. An incident record should lead to proportionate investigation and, where necessary, a changed control. A useful system lets the employer trace the route from risk to action to check.

Keep ownership clear. Someone should know who can approve a change to a method, how workers receive it and which old instruction must be withdrawn. If the organisation uses shared files or software, access and version control should support that process. A folder full of PDFs is not automatically an effective management system, and a dashboard cannot decide what precautions are adequate for a particular task.

Workers and managers should be able to find what they need without navigating a complex compliance taxonomy. If a record is essential at the point of work, store or communicate it in a way that works there. For businesses reviewing software, HSE's management-system guidance is a useful starting point for defining the process before comparing tools. Confirm any vendor's actual features, access rules and commercial terms directly before relying on it for a control or record.

Common mistakes to avoid

Treating ISO certification as the legal duty. The legal duty concerns suitable arrangements and other applicable requirements. ISO 45001 is one optional framework. Keep the law, HSE guidance and a client's certification condition separate.

Writing a system before understanding the work. A generic document may miss the actual job, site interfaces and unusual tasks. Start with the real activities and the people exposed, then choose controls and records that help.

Counting completed forms instead of testing controls. A form can show a decision was recorded. It does not show a guard, isolation point or handover was effective. Look at the work and follow up defects.

Using a universal cadence or score. HSG65 does not prescribe one inspection cycle or numerical passing mark for every workplace. Let the work, risk and any specific legal rule guide the check.

Keeping a review separate from change. A review that identifies a problem but does not assign action, communicate a new method and verify the result has not completed the management loop.

Outsourcing responsibility without coordination. A consultant may provide competent advice, and a contractor may carry out specialist work, but the employer still needs to understand its own duties, interfaces and decisions. Use HSE's getting-help guidance when deciding what assistance is needed.

Start with a proportionate management routine

Write down the work and significant risks you need to manage. Confirm who decides, who does the work and how concerns reach them. Put the agreed controls where people can use them. Check how the work actually happens. When the evidence shows a gap, change the arrangement and check again. This is the practical meaning of HSE's Plan, Do, Check, Act approach.

For a new employer, HSE's risk-management steps provide a focused starting task. For a team considering formal certification, use HSE's ISO 45001 discussion to understand the relationship between the standard and legal duties. If you are comparing ways to organise records and actions across a business, start with the tasks in your management system and ask vendors to demonstrate those exact workflows. A tool can support a process, but the employer must still judge its risks, choose suitable controls and make sure they work.

Primary sources